CVE-2023-50975

The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled i.e., ELECTRONRUNASNODE can be used in production. This makes it easier for a compromised process to access banking information...

CVE-2023-50975

The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled i.e., ELECTRONRUNASNODE can be used in production. This makes it easier for a compromised process to access banking information...

OpenVPN Connect Security Breach

OpenVPN Connect is a VPN Virtual Private Network client application from US-based OpenVPN. A security vulnerability exists in OpenVPN Connect that originates from allowing a local attacker to execute arbitrary code in the context of a nodejs process via the ELECTRONRUNASNODE environment variable...

CVE-2023-39249

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables...

PT-2024-12785 · Dell · Dell Supportassist

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist for Business PCs version 3.4.0 Description: The issue allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary...

Kap security breach

Kap is an open source screen recorder from Wulkano Open Source. Kap 3.6.0 version of the previous security vulnerability , the vulnerability stems from the RunAsNode and enableNodeClilnspectArguments settings can execute arbitrary code...

PT-2024-20048 · Kap · Kap

Name of the Vulnerable Software and Affected Versions: Kap for macOS versions 3.6.0 and earlier Description: The issue allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. Recommendations: For Kap for macOS versions 3.6.0 and earlier, at...

PT-2024-20050 · Loom · Loom

Name of the Vulnerable Software and Affected Versions: Loom on macOS version 0.196.1 and before Description: An issue in Loom allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. The vendor disputes this issue because it requires local...

Evernote Security Breach

Evernote Impression Notes is a suite of note-taking software for the macOS platform from the American company Evernote. The software allows you to create, manage, synchronize, search and share notes anytime, anywhere. A security vulnerability exists in Evernote macOS version v.10.68.2, which...

CVE-2023-49314

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack...

SUSE CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

PT-2023-31438 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.12 through 16.2.7 GitLab versions 16.3 through 16.3.4 Description: A critical vulnerability in GitLab allows attackers to run pipelines as other users, potentially granting access to internal repositories and closed project...

PT-2023-29005 · Microworld · Microword Escan Antivirus

Name of the Vulnerable Software and Affected Versions: MicroWorld eScan Anti-Virus version 7.0.32 Description: A critical vulnerability was found in MicroWorld eScan Anti-Virus on Linux, affecting an unknown part of the file runasroot. The manipulation leads to incorrect execution-assigned...

sudo: arbitrary file write with privileges of the RunAs user

A vulnerability was found in sudo. Exposure in how sudoedit handles user-provided environment variables leads to arbitrary file writing with privileges of the RunAs user usually root. The prerequisite for exploitation is that the current user must be authorized by the sudoers policy to edit a fil...

sudo: arbitrary file write with privileges of the RunAs user

A vulnerability was found in sudo. Exposure in how sudoedit handles user-provided environment variables leads to arbitrary file writing with privileges of the RunAs user usually root. The prerequisite for exploitation is that the current user must be authorized by the sudoers policy to edit a fil...

SUSE CVE-2017-8438

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

SUSE CVE-2019-11245

In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 root on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. ...

GHSA-VPQM-88C4-X4CV Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

MicroWorld Technologies eScan Anti-Virus 输入验证错误漏洞

MicroWorld Technologies eScan Anti-Virus is an Internet security solution from MicroWorld Technologies, USA. It provides virus protection for enterprise and home SOHO users. The MicroWorld Technologies eScan Anti-Virus is prone to an input validation error vulnerability that originates from inval...

Palo Alto Networks Cortex XDR Agent 代码问题漏洞

Palo Alto Networks Cortex XDR Agent is a client software for checking the security of client devices from Palo Alto Networks Malaysia. A security vulnerability exists in Palo Alto Networks Cortex XDR Agent that originates from improper control of user control files. The vulnerability can be...